Well sure after Irregular fell on its face and took the L publicly, the labs thought oh we can just do it ourselves, and also failed to do even the most basic defenses.

They just lost their scapegoat in the second round, putting the blame squarely and directly on the lab.

I totally believe AI models will be able to find any software flaws that exist and those are certainly plentiful, but I do not believe the models grew arms and plugged an ethernet cable into their private network linking them to the outside world.

The last decade of my career has focused on auditing and building systems that protect hundreds of billions of dollars in financial assets across many major institutions. Much of it not connected to the internet in any way, and sometimes offline server racks built to NSA Tempest specifications in underground bank vaults so we anchor security down to the laws of physics as appropriate. These are knobs that exist for many classes of compute including AI.

But with a bit of thought you do not even have to go anywhere near that far these days.

If the servers where models are being tested were running deterministic, immutable, full source bootstrapped, memory safe, and multi-party reviewed/reproduced/signed operating systems that execute all AI workloads in confidential VMs cryptographically remotely attested at all times by both the TPM2 and the CPUs with the only access to the outside world being a single vsock connection where prompts go in and plaintext results come out… the escapes will stop.

I'm curious if you're familiar with the particulars of how Huggingface was hacked. They were negligent in their own ways and rights. Mounting a host path volume in a Kubernetes pod is really not "super hacker" territory!